       (let [config (assoc (testutils/master-settings confdir)
                           :csr-attributes
                           (csr-attributes-file "insecure_csr_attributes.yaml"))]
-        (is (thrown-with-slingshot?
-              {:kind :disallowed-extension
-               :msg "Found extensions that are not permitted: 1.2.3.4"}
+        (is (thrown+?
+              [:kind :disallowed-extension
+               :msg "Found extensions that are not permitted: 1.2.3.4"]
               (create-master-extensions subject subject-pub issuer-pub config)))))
 
     (testing "invalid DNS alt names are rejected"
       (let [dns-alt-names "*.wildcard"]
-        (is (thrown-with-slingshot?
-              {:kind :invalid-alt-name
-               :msg "Cert subjectAltName contains a wildcard, which is not allowed: *.wildcard"}
+        (is (thrown+?
+              [:kind :invalid-alt-name
+               :msg "Cert subjectAltName contains a wildcard, which is not allowed: *.wildcard"]
               (create-master-extensions subject subject-pub issuer-pub
                                         (assoc (testutils/master-settings confdir)
                                                :dns-alt-names dns-alt-names))))))

          (testing "CSR will not be saved when"
            (doseq [[policy subject csr-file expected]
                    [["subject-hostname mismatch" "foo" "hostwithaltnames.pem"
                      {:kind :hostname-mismatch
                       :msg "Instance name \"hostwithaltnames\" does not match requested key \"foo\""}]
                     ["subject contains invalid characters" "super/bad" "bad-subject-name-1.pem"
                      {:kind :invalid-subject-name
                       :msg "Subject contains unprintable or non-ASCII characters"}]
                     ["subject contains wildcard character" "foo*bar" "bad-subject-name-wildcard.pem"
                      {:kind :invalid-subject-name
                       :msg "Subject contains a wildcard, which is not allowed: foo*bar"}]]]
              (testing policy
                (let [path (path-to-cert-request (:csrdir settings) subject)
                      csr  (io/input-stream (test-pem-file csr-file))]
                  (is (false? (fs/exists? path)))
                  (is (thrown-with-slingshot? expected (process-csr-submission! subject csr settings)))
                  (is (false? (fs/exists? path)))))))

          (testing "CSR will be saved when"
            (doseq [[policy subject csr-file expected]
                    [["subject alt name extension exists" "hostwithaltnames" "hostwithaltnames.pem"
                      {:kind :disallowed-extension
                       :msg (str "CSR 'hostwithaltnames' contains subject alternative names "
                                     "(DNS:altname1, DNS:altname2, DNS:altname3), which are disallowed. "
                                     "Use `puppet cert --allow-dns-alt-names sign hostwithaltnames` to sign this request.")}]
                     ["unknown extension exists" "meow" "meow-bad-extension.pem"
                      {:kind :disallowed-extension
                       :msg "Found extensions that are not permitted: 1.9.9.9.9.9.9"}]
                     ["public-private key mismatch" "luke.madstop.com" "luke.madstop.com-bad-public-key.pem"
                      {:kind :invalid-signature
                       :msg "CSR contains a public key that does not correspond to the signing key"}]]]
              (testing policy
                (let [path (path-to-cert-request (:csrdir settings) subject)
                      csr  (io/input-stream (test-pem-file csr-file))]
                  (is (false? (fs/exists? path)))
                  (is (thrown-with-slingshot? expected (process-csr-submission! subject csr settings)))
                  (is (true? (fs/exists? path)))
                  (fs/delete path)))))))


    (testing "when false"
      (let [settings (assoc settings :allow-duplicate-certs false)]
        (testing "throws exception if CSR already exists"
          (is (thrown+?
               [:kind :duplicate-cert
                :msg "test-agent already has a requested certificate; ignoring certificate request"]
               (process-csr-submission! "test-agent" (csr-stream "test-agent") settings))))

        (testing "throws exception if certificate already exists"
          (is (thrown+?
               [:kind :duplicate-cert
                :msg "localhost already has a signed certificate; ignoring certificate request"]
               (process-csr-submission! "localhost"
                                        (io/input-stream (test-pem-file "localhost-csr.pem"))
                                        settings)))
          (is (thrown+?
               [:kind :duplicate-cert
                :msg "revoked-agent already has a revoked certificate; ignoring certificate request"]
               (process-csr-submission! "revoked-agent"
                                        (io/input-stream (test-pem-file "revoked-agent-csr.pem"))
                                        settings))))))
